📦

caldera

Vendor: mitre

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 5 Code Available
Total RCEs 4 Remote Access
Total CVEs 13 Total Indexed
Avg. EPSS 2.86% Exploit Prob.
Latest CVE CVE-2022-40606 Oct 17

Security Vulnerability Index

Page 2 / 2
5.3 CVSS
CVE-2020-10807

auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host header.

EPSS: 1.44%
7.5 CVSS
CVE-2014-2936
RCE

The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php.

EPSS: 1.61%
10.0 CVSS
CVE-2014-2935
RCE

costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.

EPSS: 4.37%
7.5 CVSS
CVE-2014-2934
Exploit Found

Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php.

EPSS: 1.54%
5.0 CVSS
CVE-2014-2933

Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname.

EPSS: 3.00%